As per the diagram (I found it really hard to explain). The ISP router is the internet gateway. The HH5 is running OpenWrt with Luci. Obviously ideally the Pi or laptop which is the firewall and VPN server would have 2 interfaces, one for the internal network and one for the external side, but they don't and I prefer not to add USB ethernet adapters.
I could use a managed switch but its a waste of electricity, if I can use the HH5 as a managed switch, since its already there as an access point, that would be great.
So to do this I would need to bind port 1 to vlan 1, port 2 to vlan 2, and then use port 3 as a trunk port over which both vlans can transfer packets. The HH5 wireless adapter would be bound to vlan 2. And on the laptop / PI its single interface would be a trunk for both vlans.
But I don't know if I can configure the HH5 to do this. I'm not sure what its internal switch capabilities are. Any pointers would be highly appreciated.